Possible new ideas for challenges

This ticket is for creating/listing possible ideas. If an Idea is picked up by a developer, then it gets its own tickets.

• #44
• #43
• Google support (https://github.com/commjoen/wrongsecrets/issues/40, https://github.com/commjoen/wrongsecrets/issues/39),
• #93
• Alibaba cloud support (will not do this, maybe have a write up later?)
• #299
• Heroku support
• #144
• Secret in logs (= challenge 8)
• #187
• #188
• #189
• #199
• #200
• #201
• #148
• Hardcoded in testcode (https://github.com/commjoen/wrongsecrets/issues/37#issuecomment-1011482070)
• #296
• #810
• #815
• #297
• #811
• #812
• have a too long living OIDC token which can be used to extract and apply (wont'do)
• Jenkins or other github secondary ci/cd secret (won't do, as it requiers another container next to it & needs maintenance. Our current ci/cd action shows the issue already.
• #345
• Simple one that is a mix of 1 & 13: docker container is run with password as parameter, but the whole command is placed in a .sh file and stored in the git repo (aka: use .gitignore to block local helper scripts)
• #344
• SOPS/sealed secrets misconfig : a bogus sealed secret with misconfigured retrieval setup? (pending)
• #615
• #614
• #613
• #377
• #616
• #809
• #813
• Based on @robvanderveer his suggestion: https://github.com/OWASP/wrongsecrets/issues/616
• Have passwordless challenges based on impersonation such as https://github.com/OWASP/wrongsecrets/blob/master/src/main/resources/explanations/challenge11_hint-azure.adoc - agreed to not create a new challenge, but extend GCP/AWS with a similar solution for cahllenge 11.
• #814
• Bad RSA private key redaction; https://www.hezmatt.org/~mpalmer/blog/2020/05/17/private-key-redaction-ur-doin-it-rong.html (tip from @nbaars )
• A kotlin binary

Review the unchecked entries (#810, #345, the RSA redaction idea, and the Kotlin binary idea) and their linked issue context first. Done means selecting one concrete challenge idea and moving it into its own issue, as this ticket requests.